SecuriTricks - CVE-2024-45164

Description

Akamai SIA (Secure Internet Access Enterprise) ThreatAvert, in SPS (Security and Personalization Services) before the latest 19.2.0 patch and Apps Portal before 19.2.0.3 or 19.2.0.20240814, has incorrect authorization controls for the Admin functionality on the ThreatAvert Policy page. An authenticated user can navigate directly to the /#app/intelligence/threatAvertPolicies URI and disable policy enforcement.

Product(s) Impacted

Vendor	Product	Versions
Akamai	Secure Internet Access Enterprise Threatavert	19.2.0.2

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-732

Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

CWE-863

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	akamai	secure_internet_access_enterprise_threatavert	19.2.0.2	/	/	/	/	/	/	/

References

https://notes.netbytesec.com/2024/11/cve-2024-45164-broken-access-control.html

https://www.akamai.com/global-services/support/vulnerability-reporting

CVSS Score

7.1 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: LOW
Scope: UNCHANGED
Confidentiality Impact: HIGH
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

View Vector String

Timeline

Published: Nov. 4, 2024, 2:15 p.m.
Last Modified: Nov. 6, 2024, 5:35 p.m.

Status : Modified

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cve@mitre.org

CVE-2024-45164